ghndrx/prowler
1
0
Fork 0
mirror of https://github.com/ghndrx/prowler.git synced 2026-02-11 07:15:15 +00:00
Code Issues Packages Projects Releases Wiki Activity

Merge pull request #232 from rheak/master

Browse Source 
Update Scored Value for 115 and 315. Update 13 to only check users with enabled console password.
This commit is contained in:
Toni de la Fuente
2018-08-14 10:18:39 -04:00
committed by GitHub
parent b59aaf40d4 3ef5a42b73
commit ebceebbc75
1 changed files with 9 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files

26
checks/check13
View File

@@ -17,25 +17,17 @@ CHECK_ALTERNATE_check103="check13"
check13(){ check13(){
# "Ensure credentials unused for 90 days or greater are disabled (Scored)" # "Ensure credentials unused for 90 days or greater are disabled (Scored)"
COMMAND12_LIST_USERS_WITH_PASSWORD_ENABLED=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$4 }' |grep true | awk '{ print $1 }') COMMAND12_LIST_USERS_WITH_PASSWORD_ENABLED=$(cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$4 }' |grep true | awk '{ print $1 }')
# Only check Password last used for users with password enabled
if [[ $COMMAND12_LIST_USERS_WITH_PASSWORD_ENABLED ]]; then if [[ $COMMAND12_LIST_USERS_WITH_PASSWORD_ENABLED ]]; then
COMMAND13=$(
for i in $COMMAND12_LIST_USERS_WITH_PASSWORD_ENABLED; do for i in $COMMAND12_LIST_USERS_WITH_PASSWORD_ENABLED; do
cat $TEMP_REPORT_FILE|awk -F, '{ print $1,$5 }' |grep $i| awk '{ print $1 }'|tr '\n' ' '; DATEUSED=$($AWSCLI iam list-users --query "Users[?UserName=='$i'].PasswordLastUsed" --output text $PROFILE_OPT --region $REGION | cut -d'T' -f1)
done) HOWOLDER=$(how_older_from_today $DATEUSED)
# list of users that have used password if [ $HOWOLDER -gt "90" ];then
USERS_PASSWORD_USED=$($AWSCLI iam list-users --query "Users[?PasswordLastUsed].UserName" --output text $PROFILE_OPT --region $REGION) textFail "User \"$i\" has not logged in during the last 90 days "
if [[ $USERS_PASSWORD_USED ]]; then else
# look for users with a password last used more or equal to 90 days textPass "User \"$i\" found with credentials used in the last 90 days"
for i in $USERS_PASSWORD_USED; do fi
DATEUSED=$($AWSCLI iam list-users --query "Users[?UserName=='$i'].PasswordLastUsed" --output text $PROFILE_OPT --region $REGION | cut -d'T' -f1) done
HOWOLDER=$(how_older_from_today $DATEUSED)
if [ $HOWOLDER -gt "90" ];then
textFail "User \"$i\" has not logged in during the last 90 days "
else
textPass "User \"$i\" found with credentials used in the last 90 days"
fi
done
fi
else else
textPass "No users found with password enabled" textPass "No users found with password enabled"
fi fi